FalconHound for Automated BloodHound Monitoring

FalconHound is a blue team security tool that automates the integration of security telemetry with BloodHound, helping defenders maintain an up-to-date view of their Active Directory and cloud environments. It connects log aggregation platforms and security tools with BloodHound’s graph database, making it easier to identify attack paths, investigate incidents, and improve security monitoring.

BloodHound traditionally represents an environment at a particular point in time. However, users, groups, computers, sessions, and permissions can change frequently. FalconHound addresses this limitation by using information from SIEM platforms and security tools to update the graph as new events occur.

For blue teams, this approach is especially useful for tracking local group memberships and active sessions, which can be difficult to collect through conventional BloodHound data collection alone. FalconHound can ingest relevant security events, update graph relationships, and help defenders identify potentially dangerous changes before they lead to compromise.

Key Features of FalconHound

• Automated graph updates: Keep BloodHound data aligned with changes detected in the monitored environment.
• Attack path analysis: Identify paths from users or computers to sensitive groups and privileged accounts.
• SIEM integration: Use security events from supported platforms to update graph data and support alerting workflows.
• Incident enrichment: Mark users and computers as compromised when supported incident data indicates a security issue.
• Security data enrichment: Add vulnerability information, including CVEs and public exploit availability, to improve investigation context.
• Enrichment lists: Generate data for SIEM platforms, such as lists of Kerberoastable users or users who own specific entities.

Supported Data Sources and Targets

FalconHound is designed to complement BloodHound rather than replace it. It currently supports integrations with several data sources and destinations:

• Microsoft Sentinel, formerly Azure Sentinel
• Microsoft Sentinel Watchlists
• Splunk
• Microsoft Defender for Endpoint (MDE)
• Neo4j
• Microsoft Graph API, with support described by the project as early-stage
• CSV files

In the documented setup, FalconHound uses the Neo4j database associated with BloodHound. Support for the BloodHound Community Edition and BloodHound Enterprise APIs has been under development, so check the current project documentation for compatibility with your deployment.

Installation and Requirements

FalconHound is written in Go and provides precompiled binaries for Windows, Linux, and macOS. Download the appropriate build from the official FalconHound releases page.

Before running the tool, prepare a YAML configuration file using the example provided in the project repository. Configure the required credentials and permissions for each connected platform by following the required permissions guide.

The main requirements include:

• A BloodHound environment or its Neo4j database.
• A supported SIEM or log aggregation platform, such as Microsoft Sentinel or Splunk.
• Valid credentials with the permissions needed to access each configured endpoint.
• A configuration file containing the connection details and settings for the selected integrations.

For related Active Directory security analysis, explore Adalanche for Active Directory attack-path analysis.

Running FalconHound

After downloading the binary and configuring the required integrations, run FalconHound with the -go parameter to execute the queries in the actions folder:

./falconhound -go

Use the executable appropriate for your operating system and consult the current repository documentation for platform-specific command syntax and configuration options.

For continuous monitoring, the project recommends scheduling FalconHound with a cron job on Linux or macOS, or a scheduled task on Windows. Regular execution can help keep graph data, alerts, and enrichment information current.

Blue Team Use Cases

FalconHound can support several defensive workflows when connected to reliable telemetry sources:

• Update or expire graph sessions based on logon and logoff events.
• Mark accounts and endpoints as compromised following incidents detected by Microsoft Sentinel or Microsoft Defender for Endpoint.
• Refresh attack-path calculations when users join groups or receive new roles.
• Add newly discovered users, groups, and computers to the graph.
• Enrich graph data with vulnerability details and exploit availability.
• Build investigation lists for Sentinel and Splunk, including privileged users and accounts with specific ownership relationships.
• Send graph-derived findings to monitoring systems when changes create a path to a sensitive group.

These workflows can help defenders connect individual security events with their broader impact on an organization’s identity infrastructure. Review permissions, validate incoming telemetry, and test alert logic in a controlled environment before deploying automated updates to production.

For further implementation details and examples, read the FalconForce article on FalconHound and attack-path management and consult the official FalconHound repository.